Bulletproof Hosting Watch: Week of 2026-08-02

Executive Summary

After exhaustive Honeylabs querying across all 26 ASNs, 7 providers generated observable honeypot events. The remaining 19 ASNs produced significant Sponge network-sensor traffic but zero honeypot interaction, confirming targeted scanning against real infrastructure rather than opportunistic global spraying.

The most notable finding is the diversity of attack profiles. Pfcloud UG (AS51396) continues its proxy-validation campaign. PLI-AS (AS51852) demonstrated the widest attack surface: DCE/RPC endpoint enumeration, RDP brute-force with “Administrator” credentials, tRPC setup endpoint attacks on port 3000, and WordPress login scanning. KPRONET (AS214940) ran a sustained .git and .env file exfiltration campaign with randomized user-agent spoofing across dozens of browser profiles. PROTON66 (AS198953) executed a dense MSSQL-TDS brute-force campaign from a single Russian IP. FLOKINET (AS200651) operated SSH and Telnet brute-force from a Tor exit relay node in Romania. HOSTKEY (AS57043) ran an RTSP camera credential-stuffing campaign against Hikvision ISAPI endpoints.

Censys per-IP enrichment confirmed BULLETPROOF labeling for every queried host and revealed that FLOKINET 185.100.87.136 operates as a Tor exit relay with OpenSSH 9.9 on an alternative port.

By the Numbers

“Others” includes 9 ASNs with negligible or zero Sponge activity.

Top ASN Deep Dives

AS51852 (PLI-AS / Private Layer INC)

PLI-AS presented the most operationally diverse threat profile of any provider this week. Four distinct attack types originated from Swiss-registered infrastructure (Panama-incorporated Private Layer INC):

81.17.28.130 executed repeated DCE/RPC endpoint enumeration against port 135. The binary payloads contain MSRPC bind requests with UUIDs matching standard Windows RPC services (IOXIDResolver, epmapper, etc.). Censys enrichment confirms BULLETPROOF labeling, true hosting infrastructure, and a Panama shell-company WHOIS registration.

179.43.186.199 launched RDP brute-force attempts with “Cookie: mstshash=Administrator”, targeting RDP port 3389. This is a clear lateral-movement or initial-access pattern using the “Administrator” account as the first credential test. The timing pattern shows rapid retries, consistent with automated brute-force tooling.

179.43.150.26 targeted port 3000 with POST requests to /api/trpc/setup.setup. The JA4H fingerprint po11nr09en_94d98df401ed combined with a Windows Chrome 143 user-agent impersonation indicates this is targeting tRPC-based applications (likely Homarr or similar self-hosted dashboards). The setup endpoint is a common first-run configuration target that may permit unauthenticated configuration changes.

179.43.158.246 probed /wp-login.php over TLS with Go-http-client/1.1 (TLS JA4 t13i190900_9dc949149365_e7c285222651), performing WordPress credential enumeration. The rapid fallback from TLS to plaintext HTTP on different ports suggests a multi-phase scan pipeline.

All PLI-AS hosts resolve to hostedby.privatelayer.com reverse DNS, providing a clear operational grouping signal for detection.

AS214940 (KPRONET / Kprohost LLC)

KPRONET ran a disciplined secrets-exfiltration campaign from Ukranian IPs 77.83.39.94, 77.83.39.6, and 77.83.39.24. Every event targeted either .env or .git/ paths (.git/HEAD, .git/index, .git/config) over TLS port 443. The operation used randomized user-agent strings spanning 20+ distinct browser profiles: Safari on Mac, Chrome on Android devices, Firefox on Linux and Windows, Opera Mobile, even the Chinese LBBROWSER and MQQBrowser/WeChat embedded browser. The campaign maintained a consistent TLS fingerprint (JA4 t13i190800_9dc949149365_97f8aa674fd9 or t13i251000_b78ed14e2fd0_ab7e3b40a677) and identical HTTP fingerprint (JA4H ge11nn0500_9af7e0472034) across all user-agent rotations. This fingerprint consistency provides a reliable detection signal despite the user-agent chaff.

The .env targeting is particularly significant: .env files commonly contain database credentials, API keys, and application secrets in plaintext. Combined with .git/config scanning (which can reveal repository remotes and credentials), this campaign is systematic credential harvesting for pivoting into victim infrastructure.

AS198953 (PROTON66 OOO)

PROTON66’s 176.120.22.61 (Russia, St. Petersburg) conducted a high-density MSSQL-TDS brute-force campaign against 20+ distinct high ports in a single burst on August 2, 04:40 UTC. The TDS pre-login packets (\x12\x01\x00\x1a...) targeted ports ranging from 1,434 to 61,433. The port selection pattern suggests the attacker is scanning for SQL Server instances on non-standard ports, possibly targeting compromised hosts where MSSQL was moved off default port 1433 to evade detection. The event burst timing (all within ~7 seconds) indicates a rapid network scan, not a targeted credential attempt.

This campaign is notable because MSSQL brute-force is less common than SSH or RDP in global honeypot data, yet PROTON66 showed no SSH activity in Honeylabs (only in Sponge sensor data). This split between sensor visibility and honeypot interaction suggests two separate operational teams, or a split between infrastructure mapping (visible to Sponge) and exploitation (visible to Honeylabs).

AS200651 (FLOKINET ehf)

FLOKINET IP 185.100.87.136 (Romania, Bucharest) generated the richest per-IP Censys profile of any host this week. Censys reveals it is a Tor exit relay (fingerprint 9366185B4ECB1CC3634F475D20FDDFE7A302BAF2, nickname “PremiumTorExit”, Tor 0.4.9.11 on Linux) serving a “This is a Tor Exit Router” notice page on port 80. It also runs OpenSSH 9.9 on port 7288 (HASSH b1bff636ebbdbaa9dd2ad97fd173c956) and a TLS service on port 9001 with a self-signed certificate (CN www.vvbvnjjigucqnnzw6kal.net issued by www.j4qyufou3gapckni6res.com, a typo-squatting hostname indicating potential phishing infrastructure).

The Honeylabs event stream from this IP confirms: SSH brute-force with OpenSSH 10.1 (HASSH e54ef3ec27fe1fea7ab64d3fa05359fd), binary/REDIS probes on port 443 (“READY\n”), and a separate FLOKINET IP 185.246.188.74 running Telnet brute-force with “root/tl789” and “root/gforge” credential pairs.

The combination of Tor exit relay + SSH brute-force + Telnet brute-force + phishing-adjacent TLS certificate infrastructure makes this the most concerning single IP in this week’s dataset.

AS57043 (HOSTKEY B.V.)

HOSTKEY IP 163.5.29.40 (Netherlands, Amsterdam) ran an RTSP camera credential-stuffing attack against ISAPI streaming endpoints. The payload targets Hikvision cameras (path /ISAPI/Streaming/channels/10101 and /Streaming/Channels/10201) with RTSP DESCRIBE requests carrying Basic authentication headers. The credential list includes: admin:admin, admin:123456, admin:12345678, admin:qwerty, admin:qwerty123, admin:pass, admin:admin1, admin:admin!!, admin:klv123, admin:3245gs5662d34. The attacker alternated between cleartext credentials in the URL and Base64-encoded Authorization headers, suggesting either multiple tools or a credential-stuffing framework iterating through a dictionary.

AS51396 (PFCLOUD / Pfcloud UG)

PFCLOUD remained the most active BP ASN by raw event count, with 8,400 Honeylabs events and 10,000+ Sponge sessions. The activity profile is unchanged from prior weeks: SOCKS5 proxy validation, HTTP CONNECT tunnel testing to proxy2.proxiesfood.com:443, SSH service discovery with OpenSSH banners, and zgrab web scanning (JA4H ge11nn0400_88d30a62b7ad). Censys ports show systematic offset pairing (N and N+10000) across the fleet, a strong signal of automated proxy infrastructure provisioning.

Infrastructure Correlation

FLOKINET Tor exit relay is the most infrastructure-rich finding. IP 185.100.87.136 combines Tor exit capability, non-standard SSH, TLS service with suspicious self-signed certificate, and active brute-force behavior. The Tor exit relay means any traffic exiting through this node appears to originate from this IP, providing FLOKINET with a layer of attribution ambiguity.

PLI-AS infrastructure is Swiss-located, Panama-incorporated. All PLI-AS IPs resolve to hostedby.privatelayer.com in Swiss data centers (Zurich and Rumlang), but the corporate entity is Panama-registered Private Layer INC. This legal/geographic separation is a classic bulletproof hosting pattern.

KPRONET fingerprint consistency enables detection. Despite rotating through 20+ user-agent strings, KPRONET maintains identical TLS JA4 and HTTP JA4H fingerprints. Network defenders can detect this campaign with JA4H ge11nn0500_9af7e0472034 targeting .env or .git paths, regardless of user-agent rotation.

Fleet Observations

• SSH exposure is near-total: Port 22 is the most common open service across all Censys-profiled ASNs. HOSTKEY (75,854) and AEZA (59,807) lead, but even the smaller ASNs show 40-70% SSH prevalence.
• Port 2096 as proxy signal: Both HOSTKEY (15,202) and AEZA (12,444) show massive port 2096 exposure, associated with WebSocket/Cloudflare proxy tunnels.
• KAOPU-HK continues NTP amplification mapping: Despite zero Honeylabs events, KAOPU-HK dominates Sponge volumes with 818K sessions from a single IP exclusively targeting NTP port 123 and SSDP port 1900.
• FLOKINET Tor relay: The only confirmed Tor exit node among monitored ASNs, combining anonymity infrastructure with direct brute-force activity.

IoCs and Detection Guidance

Notable IPs (with Censys enrichment):

• 185.100.87.136 — FLOKINET Tor exit relay + SSH brute (OpenSSH 10.1), GreyNoise: malicious, Tor 0.4.9.11
• 163.5.29.40 — HOSTKEY RTSP camera credential stuffing, WHOIS: French university
• 81.17.28.130 — PLI-AS DCE/RPC scanner, BULLETPROOF, Panama shell company
• 179.43.186.199 — PLI-AS RDP brute (Administrator), Switzerland-based
• 179.43.150.26 — PLI-AS tRPC setup endpoint attacker, JA4H po11nr09en_94d98df401ed
• 176.120.22.61 — PROTON66 MSSQL-TDS brute-forcer, Russia
• 77.83.39.94 — KPRONET .git/.env exfiltration, Ukraine, 20+ spoofed UAs
• 77.83.39.6 — KPRONET .env campaign, JA4H ge11nn0500_9af7e0472034
• 144.172.100.235 — ROUTERHOSTING binary protocol scanner
• 204.76.203.78-80 — PFCLOUD SOCKS5 proxy checker
• 185.100.87.136 — FLOKINET SSH brute (OpenSSH_10.1), HASSH e54ef3ec27fe1fea7ab64d3fa05359fd
• 185.246.188.74 — FLOKINET Telnet brute (root/tl789, root/gforge)

Fingerprints:

• JA4 t13i190800_9dc949149365_97f8aa674fd9 — KPRONET .env exfiltration campaign TLS
• JA4H ge11nn0500_9af7e0472034 — KPRONET .env/.git HTTP fingerprint (detects regardless of UA rotation)
• JA4 t13i251000_b78ed14e2fd0_ab7e3b40a677 — KPRONET .git/HEAD scanning TLS
• JA4H po11nr09en_94d98df401ed — PLI-AS tRPC setup endpoint attack
• JA4 t13i190900_9dc949149365_e7c285222651 — PLI-AS WordPress login scanning
• HASSH e54ef3ec27fe1fea7ab64d3fa05359fd — FLOKINET OpenSSH 10.1 SSH brute client
• HASSH b1bff636ebbdbaa9dd2ad97fd173c956 — FLOKINET Tor relay SSH (OpenSSH 9.9, port 7288)

Detection Patterns:

• KPRONET .env/.git scanning: TLS JA4 t13i190800 with path /.env or /.git/, JA4H ge11nn0500_9af7e0472034
• PLI-AS DCE/RPC: MSRPC bind to port 135 from hostedby.privatelayer.com reverse DNS
• FLOKINET SSH: OpenSSH_10.1 with HASSH e54ef3ec27fe1fea7ab64d3fa05359fd
• PROTON66 MSSQL: TDS pre-login packets from 176.120.22.0/24
• PFCLOUD port pairing: service on port N and N+10000 simultaneously

Full data: https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-08-02/